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Thirty  years  ago,  at  the  dawn  of  the  digital  age,  the  notion  of  a 
synthetic,  virtual  realm  where  human  beings  would  interact 
and  compete  was  largely  the  stuff  of  science  fiction.1  We 
thrilled  to  films  like  Tron  and  WarGames;  we  shuddered  to  think  that 
“Skynet”  might  become  self-aware,  as  foretold  in  the  movie  Terminator. 
When  the  movie  was  over,  however,  we  rubbed  the  nightmare  out  of 
our  eyes  and  stepped  back  into  the  light  of  the  “real”  world. 

Today,  we  see  cyberspace  as  more  than  a  flight  of  sci-h  fancy:  we 
consider  it  an  operational  domain,  as  significant  as  the  four  traditional 
environments  of  land,  sea,  air,  and  space.2  Yet  cyberspace  differs  obvi¬ 
ously  from  those  more  familiar,  natural  domains.  How  does  intelli¬ 
gence,  surveillance,  and  reconnaissance  (ISR)  apply  to  this  new,  dy¬ 
namic,  and  artificially  crafted  environment?  What  challenges  face  the 
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Air  Force  ISR  enterprise  as  it  seeks  to  understand  this  novel  opera¬ 
tional  realm?  Finally,  what  should  that  enterprise  do  in  order  to  meet 
the  problems  and  demands  inherent  in  cyberspace?  This  article  ad¬ 
dresses  each  of  these  fundamental  questions  in  turn.3 


Defining  Cyber  Intelligence, 

Surveillance,  and  Reconnaissance 

Unlike  ISR  operations  in  the  natural  domains,  those  in  cyberspace 
have  yet  to  be  formally  defined  in  joint  or  service  doctrine.  Despite 
wide  reference  to  "CYBINT,”  its  relationship  to  signals  intelligence  and 
open-source  intelligence,  and  even  calls  to  establish  more  granular  dis¬ 
ciplines  such  as  "SkypeINT”  or  "VoIPINT,”  current  thinking  on  the  sub¬ 
ject  remains  immature.4  As  Lt  Gen  Larry  D.  James,  deputy  chief  of 
staff  for  ISR,  remarked  in  2011,  "We're  just  starting  to  think  through 
some  of  those  things  from  an  Air  Force  perspective.”5  Thus,  although 
the  term  cyber  ISR  has  gained  increasing  traction  within  Air  Force  ISR 
circles,  it  has  simultaneously  drawn  queries  from  elsewhere  within  the 
Department  of  Defense  (DOD)  and  the  Air  Staff  as  to  its  meaning.6 
This  article  begins  by  offering  a  conceptual  starting  point  as  a  spring¬ 
board  to  clarity  and  future  doctrinal  refinement. 

Perhaps  we  can  best  understand  cyber  ISR  through  two  component 
activities:  ISR  from  cyberspace  and  ISR  for  cyberspace.  ISR  from  cyber 
dates  back  to  the  first  efforts  to  extract  data  from  adversary  networks 
during  the  1980s,  and  analysts  today  continue  to  comb  cyberspace  for 
"any  information  of  intelligence  value  [we]  can  glean  from  that  do¬ 
main,”  according  to  Lieutenant  General  James.7  This  includes,  for  ex¬ 
ample,  foreign  news  media,  chat  rooms  frequented  by  threat  actors, 
blogs  and  video  from  crisis  areas,  or  commercial  imagery,  to  cite  just  a 
few  applications.  It  also  incorporates  the  more  familiar  concept  of 
computer  network  exploitation  (CNE).  After  collecting  this  informa¬ 
tion  in  cyberspace,  we  can  use  it  to  support  operations  in  any  domain. 
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For  its  part,  ISR  for  cyber  is  perhaps  best  defined  by  Air  Force  Policy 
Directive  10-17,  Cyberspace  Operations,  which  tasks  Air  Force  ISR  to 
“ensure  [the]  ability  to  provide  collaborative  analysis,  fused  intelli¬ 
gence,  and  cross-domain,  integrated,  and  automated  ISR  PCPAD  (plan¬ 
ning  and  collecting,  collection,  processing  and  exploitation,  analysis 
and  production,  dissemination)  capabilities  to  enable  cyberspace  op¬ 
erations.”8  This  definition  suggests  the  criticality  of  all-source  intelli¬ 
gence  during  the  planning  and  execution  of  cyberspace  operations. 
Operating  in  cyberspace  demands  more  than  just  ISR  from  cyber;  any 
intelligence  discipline  can  supply  information  of  crucial  intelligence 
value  to  cyberspace  operations.9  As  noted  by  Maj  Gen  Robert  P.  Otto, 
commander  of  the  Air  Force  ISR  Agency,  "When  we  say  'ISR  for  Cyber,' 
we  are  referring  to  the  ISR  conducted  to  support  Cyberspace  superior¬ 
ity”— regardless  of  the  source,  method,  or  medium.10 

CNE,  which  some  individuals  mistakenly  equate  to  cyber  ISR,  falls 
neatly  within  the  first  mission  area— ISR  from  cyber.  Air  Force  doc¬ 
trine  defines  CNE  as  "enabling  operations  and  intelligence  collection 
capabilities  conducted  through  the  use  of  computer  networks  to  gather 
data  from  target  or  adversary  automated  information  systems  or  net¬ 
works.”11  More  explicitly,  CNE  is  "usually  performed  through  network 
tools  that  penetrate  adversary  systems.  .  .  .  Tools  used  for  CNE  are  sim¬ 
ilar  to  those  used  for  computer  attack,  but  configured  for  intelligence 
collection  rather  than  system  disruption.”12  Both  descriptions  imply 
deliberate  intrusion  into  target  hardware,  software,  or  related  net¬ 
works.13  However,  they  do  not  incorporate  the  passive  collection  of 
open-source  information  of  potential  intelligence  value,  another  im¬ 
portant  form  of  ISR  from  cyber.  The  latter  could  include  downloading 
publicly  released  video  of  the  latest  adversary  fighter,  reading  foreign 
doctrine  or  military  publications,  monitoring  chat  rooms,  and  a  host  of 
other  activities  that  do  nothing  to— and  leave  nothing  on— a  cyber  sys¬ 
tem  or  network.  They  do,  however,  contribute  to  the  essential  purpose 
of  ISR— getting  the  right  information  to  the  right  decision  makers  at 
the  right  time. 
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Cyber  situational  awareness,  another  ISR-related  concept  that  fea¬ 
tures  prominently  in  the  relevant  literature,  concerns  the  perception, 
discernment,  and  understanding  of  who  is  present  and  what  is  occur¬ 
ring  within  cyberspace,  whether  friendly,  hostile,  or  anywhere  in  the 
gradients.14  Yet  situational  awareness  writ  large  is  more  than  ISR,  shad¬ 
ing  into  command  and  control,  non-ISR  elements  of  battlespace  aware¬ 
ness,  and  even  individual  cognition.15  While  ISR  is  central  to  situa¬ 
tional  awareness,  therefore,  the  two  should  not  be  conflated.  We  do  not 
consider  environmental  monitoring  an  intelligence-collection  disci¬ 
pline,  for  example,  although  it  is  a  function  of  battlespace  awareness 
and  involves  similarly  analytic  processes.  Nor  do  we  count  all  human 
knowledge  as  "information  of  intelligence  value”  even  though  knowl¬ 
edge  presupposes  awareness. 

Given  this  starting  point  for  defining  and  bounding  cyber  ISR,  one 
must  then  explore  the  environment  in  which  we  conduct  it.  As  the 
paragraphs  below  demonstrate,  cyberspace  as  a  domain  poses  signifi¬ 
cant  issues  that  we  must  overcome  if  we  wish  to  understand  it  fully 
and  operate  within  it  effectively. 


Challenges  of  Cyberspace 

RAND  analyst  Martin  Libicki  has  identified  a  trend  in  American  po¬ 
litical  and  strategic  thinking.  Specifically,  when  confronted  with  a  new 
paradigm  (such  as  aerial  warfare  during  World  War  I  or  the  opening  of 
space  to  military  applications),  we  generally  first  react  by  trying  to  jam 
the  square  peg  of  game-changing  innovation  into  the  round  holes  of 
the  past.  Now  that  we  have  declared  cyberspace  an  operational  do¬ 
main,  Libicki  worries  that  "we  will  take  our  old  rules  and  walk  them 
over.”  However,  he  contends  that  "you  cannot  do  that  with  cyberspace. 
You  have  to  think  about  it  from  its  [own]  principles.”16  Certainly,  broad 
and  enduring  commonalities  exist  in  ISR  tradecraft  and  other  military 
activities  across  all  domains,  but  Libicki's  fundamental  point— that  we 
cannot  simply  rewrite  existing  doctrine  and  tactics,  techniques,  and 
procedures  by  inserting  cyber  wherever  we  find  air  or  space— warrants 
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attention.  The  distinctive  nature  of  cyberspace  brings  new  opportuni¬ 
ties  as  well  as  new  challenges,  and  these  call  for  novel  ways  of  think¬ 
ing  rather  than  a  perfunctory  cookie-cutter  solution.17 

The  unique  attributes  of  this  newest  operational  milieu  distinguish 
cyber  ISR  from  complementary  activities  in  the  "natural”  domains.  In 
the  first  and  most  obvious  place,  cyberspace  was  created  by  humans, 
who  continuously  modify  it;  each  online  click  or  keystroke  by  over  2 
billion  users  ripples  through  cyberspace.  “The  other  domains  are  natu¬ 
ral,”  observes  Gen  Michael  Y.  Hayden,  USAF,  retired,  former  director 
of  the  National  Security  Agency  and  the  Central  Intelligence  Agency. 
“This  one  is  the  creation  of  man.  Man  can  actually  change  this  geogra¬ 
phy,  and  anything  that  happens  there  actually  creates  a  change  in 
someone’s  physical  space”  (emphasis  in  original).18  Cyberspace's  man¬ 
made  origin  has  resulted  in  three  facets  that  distinguish  it  from  the  rel¬ 
atively  consistent  natural  domains:  complexity,  adaptability,  and  rate 
of  change.  Granted,  nature  is  complex,  nature  adapts,  and  nature 
changes— but  not  to  the  degree  and  pace  that  cyberspace  does.  We  can 
still  recognize  the  same  mountains,  seas,  and  stars  known  to  our  an¬ 
cestors.  Today's  cyberspace,  however,  bears  virtually  no  similarity  to 
its  predecessor  of  just  two  decades  ago— the  length  of  an  individual 
military  career.19 

Regarding  complexity,  cyberspace  is  breathtakingly  intricate  and 
maddeningly  nonlinear.  Everything  can  be  connected  to  everything 
else  in  cyberspace— some  50  billion  devices  produced  to  date— while 
objectively  small  changes  routinely  produce  effects  out  of  all  propor¬ 
tion  to  their  initial  scale.20  Consequently,  cyberspace  thinking  "must 
consider  the  relationship  of  things,  i.e.  the  network,  and  how  people 
have  chosen  to  structure  and  use  the  cyberspace  domain”  (emphasis  in 
original)— no  easy  task,  given  the  number,  instability,  unpredictability, 
and  complexity  of  those  relationships.21 

Cyberspace's  inherent  adaptability  contributes  to  both  its  complexity 
and  dynamic  nature.22  It  continually  changes  (through  the  actions  of 
billions  of  disparate  users)  to  conditions  both  within  and  around  cyber- 
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space,  such  as  new  technologies,  threats,  or  policies  and  laws.  Of  note, 
the  Internet  itself  was  deliberately  designed  to  facilitate  rapid  expan¬ 
sion  and  adaptability  to  technical  innovation.23  The  changes  that 
prompt  those  adaptations  also  occur  at  a  rapid  pace  as  new,  innovative, 
and  often  unanticipated  technologies  continue  to  alter  the  cyber  land¬ 
scape  more  rapidly  than  they  change  any  other  technical  realm.24  Ac¬ 
cording  to  a  quartet  of  British  observers,  "The  pace  of  change  can  be  so 
abrupt  as  to  render  the  conventional,  action/ reaction  cycle  of  strategic 
evolution  out  of  date  before  it  has  begun:  it  is  as  if  a  government  op¬ 
erational  analyst  has  been  sent  to  observe  the  effects  in  battle  of  the 
flintlock  musket,  only  to  discover  upon  arrival  that  the  Maxim  gun  has 
been  invented.”25 

Cyberspace's  dramatic  growth  contributes  to  its  complexity  and 
adaptability.  Unlike  the  physical  domains,  which  are  relatively  con¬ 
stant  in  terms  of  size,  cyberspace  is  expanding  exponentially  in  every 
significant  respect.26  By  mid-2011 ,  more  than  2  trillion  transactions  had 
traversed  cyberspace,  involving  50  trillion  gigabytes  of  data.27  Fast- 
forward  to  2025,  when  we  can  anticipate  some  5.5  billion  digital  deni¬ 
zens,  representing  60  percent  of  the  world's  projected  population. 

They  will  use  25  million  applications  to  conduct  billions  of  interac¬ 
tions  daily,  generating  or  exchanging  50  trillion  gigabytes  of  data  per 
day.  The  online  masses  will  have  roughly  3  billion  Internet  hosts  to 
choose  from,  each  of  which  may  feature  thousands  of  individual  web¬ 
sites.28  For  those  people  seeking  to  make  sense  of  cyberspace,  its  rapid 
expansion  poses  a  compelling  problem. 

Traditionally,  military  planners  and  practitioners  have  equated  size 
and  distance  with  similar  scales  of  time:  traversing  great  distances  or 
conquering  large  areas  takes  additional  time.  It  took  more  than  a  week 
for  convoys  to  sail  from  the  United  States  to  Great  Britain  in  World  War 
II,  for  example,  and  nearly  10  months  passed  between  the  time  that 
the  Allies  landed  in  Normandy  and  their  crossing  of  the  Rhine.  In  cy¬ 
berspace,  however,  time  as  traditionally  understood  in  military  affairs 
has  become  irrelevant.29  Theoretically,  we  can  deliver  a  cyber  payload 
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from  source  to  target,  from  any  point  to  any  other  on  the  globe,  in  less 
time  than  it  takes  an  average  person  to  blink.  Cyberspace  has  given  us 
operations  at  the  "speed  of  byte.”30 

Cyberspace's  worldwide  pervasiveness,  when  combined  with  the 
speed  of  cyber  effects,  confers  a  new  and  daunting  dimension  to  the 
notion  of  "global  reach.”31  Physical  cyber  nodes  inhabit  each  of  the  nat¬ 
ural  domains— in,  around,  and  above  every  continent  and  sea.  Cyber¬ 
space  crisscrosses  the  globe,  both  drawing  people  together  to  an  un¬ 
precedented  degree  and  giving  our  foes  heretofore  unimagined 
avenues  of  attack.32  In  the  past,  war  fighters  have  always  enjoyed  dis¬ 
crete  theaters  in  which  to  operate.33  In  cyberspace,  however,  hostile  ac¬ 
tions  may  originate  in  or  be  routed  through  literally  any  location 
where  an  Internet-enabled  device  can  function.34  Furthermore,  cyber¬ 
space's  global  nature  has  rendered  traditional  borders  between  sover¬ 
eign  entities  essentially  meaningless.35  Because  of  a  savvy  adversary's 
ability  to  launch  intrusions  or  attacks  across  multiple  frontiers  with 
near  impunity,  "Geography  is  completely  irrelevant.  So  there  is  no 
use  in  determining  the  geo  location  of  some  server  where,  let's  say  a 
denial-of-service  attack  emerged  from  because  I  could  just  set  up  this 
server  that  I  use  to  launch  my  attack  in  the  United  States.  It's  not  a 
problem.  I  can  do  that.  I  can  use  a  server  in  China.  I  can  use  a  server 
in  Malaysia  or  in  Brunei.”36  The  worldwide  diffusion  and  geoambiguity 
of  cyberspace  complicate  effective  ISR,  since  there  are  no  static  physi¬ 
cal  spaces  on  which  to  focus  attention— a  radical  departure  from  geo¬ 
centric  conceptions  of  ISR. 

Not  only  nation-state  borders  but  also  nation-states  themselves  have 
become  less  relevant  in  cyberspace.  No  cyber-enabled  nation's  govern¬ 
ment  can  claim  a  monopoly  of  force  in  this  domain,  nor  can  it  assert 
total  ownership  of  the  infrastructure  vital  to  military  operations.37  In 
the  first  case,  the  low  costs  of  entry  into  cyberspace,  coupled  with  the 
widespread  availability  of  increasingly  sophisticated  threatware,  have 
presented  nonstate  actors  and  even  individuals  the  opportunity  to 
conduct  activities  formerly  the  exclusive  province  of  a  state's  security 
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apparatus.38  But  now,  in  cyberspace,  actors  "do  not  need  to  be  well  edu¬ 
cated  nor  well  resourced.  .  .  .  They  simply  need  to  have  intent  and  the 
ability  to  use  technology  to  perpetrate  their  activity.”39  Additionally, 
some  90  percent  of  cyberspace  infrastructure  is  privately  owned  despite 
its  government-sponsored  origins— and  despite  the  fact  that  our  govern¬ 
ment  and  armed  forces  rely  heavily  on  that  commercial  infrastruc¬ 
ture.40  As  a  result,  in  cyberspace  "distinctions  and  divisions  between 
public  and  private,  government  and  commercial,  military  and  non¬ 
military  are  blurred.”41 

These  characteristics  of  cyberspace  contribute  to  "the  most  vexing 
question  of  all”  for  ISR  professionals:  attribution  of  intrusions  and  at¬ 
tacks.42  As  Air  Force  Space  Command  acknowledges,  "The  ability  to 
hide  the  true  (originating)  source  of  an  attack  makes  it  difficult  to 
identify  the  attacker.  Furthermore,  the  design  of  the  Internet  lends  it¬ 
self  to  anonymity.”43  One  factor  that  complicates  attribution— the  large 
number  of  online  actors— is  reflected  by  the  difficulty  of  trying  to  un¬ 
cover  an  insider  threat  within  the  DOD.  If  each  user  represented  a 
node  and  each  e-mail  message  a  link,  one  would  have  to  analyze 
755,230,064,000  links  between  237,387,616  nodes  in  a  single  year— a 
tally  that  does  not  include  Internet  searches,  file  accessions,  or  other 
types  of  theoretically  observable  cyber  activity.44 

Compounding  the  sheer  scale  of  the  potential  target  set  are  cyber 
tools  that  complicate  attribution  further.  Botnets  ranging  up  to  millions 
of  machines,  proxy  sites  dedicated  to  anonymizing,  onion  routing,  and 
related  techniques  all  pose  intimidating  barriers  to  positive  attribu¬ 
tion.45  More  fundamentally,  the  Internet  in  particular  "operates  on  in¬ 
herently  unauthenticated  protocols,”  meaning  that  "attribution  and 
non-repudiation  collide  often  with  anonymity.”46  Though  daunting,  at¬ 
tribution  is  “not  impossible,”  according  to  Col  Daniel  Simpson,  com¬ 
mander  of  the  659th  ISR  Group;  "however,  you  need  the  work  of  good, 
hard  analysis  by  smart  ISR  professionals.”47  Despite  improvements  re¬ 
garding  attribution,  it  "is  always  going  to  be  more  difficult,”  according 
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to  William  J.  Lynn  III,  former  deputy  secretary  of  defense.  "Missiles 
come  with  a  return  address,  cyber  attacks  do  not.”48 

Incomplete  or  inaccurate  attribution  also  exposes  the  ISR  enterprise 
to  potential  violations  of  law,  policy,  and  constitutional  norms.  Not 
only  can  uncertainty  regarding  the  nature  of  an  intrusion  (domestic  or 
foreign;  criminal,  military,  or  intelligence)  delay  attribution  while  title 
10/18/50  authorities  are  untangled,  but  also  inaccurate  or  premature 
attribution  may  lead  to  infractions  under  those  authorities.49  As  former 
FBI  director  Robert  Mueller  testified,  "At  the  outset,  you  do  not  know 
whether  [a  cyber  intruder]  may  be  a  state  actor,  a  group  of  individuals 
operating  at  the  behest  of  a  state  actor,  or  a  high-school  kid  across  the 
street.”50  Proposed  solutions  to  this  challenge— such  as  data  sharing 
among  the  military,  intelligence  community,  and  industry;  more  aggres¬ 
sive,  comprehensive  collection  to  enable  proactive  defense;  or  "re¬ 
engineering”  the  Internet  to  facilitate  attribution  and  geolocation— 
have  drawn  the  ire  of  organizations  advocating  online  privacy,  civil 
liberties,  and  Internet  freedom.51  This  article  does  not  purport  to  be  a 
legal  note  or  discussion.52  Nevertheless,  it  is  worth  noting  that  we  risk 
finding  ourselves  "in  uncharted  waters  with  regard  to  cyber  law,” 
given  the  sometimes  uncertain  boundaries  between  intelligence  and 
law-enforcement  activities  in  cyberspace.53 


Way  Ahead  and  Recommendations 

Considering  the  obstacles  inherent  in  cyberspace,  the  ISR  enterprise 
must  make  and  sustain  appropriate  investments  in  ideas,  resources, 
and  personnel  if  it  wishes  to  operate  effectively  in  the  newest  domain. 
In  the  realm  of  ideas,  the  first  task  entails  determining  how  ISR  fits 
into  the  broader  scope  of  cyber  operations.  Currently,  the  Air  Force 
and  joint  community  lack  consensus  on  this  point.  Most  military  and 
national  doctrine  and  policy  publications  concentrate  on  offensive  and 
defensive  cyber  activities;  for  its  part,  ISR  is  generally  relegated  to  a 
supporting  role.  For  example,  in  2010  Air  Force  Space  Command— the 
core  function  lead  integrator  for  the  Air  Force  cyber  enterprise  — 
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described  ISR  as  a  “capability”  “necessary”  to  the  “missions"  of  cyber¬ 
space  support,  cyberspace  defense,  and  cyberspace  force  application.54 

Such  notions  fail  to  recognize  that  ISR  often  is  the  mission.  At  all 
other  times  in  the  course  of  cyber  operations,  it  remains  both  central 
and  essential.  Indeed,  operations  in  cyberspace  are  “soaked  in  intelli¬ 
gence,”  and  without  ISR,  cyber  operations  “would  be  no  better  than  the 
proverbial  shot  in  the  dark."55  Lieutenant  General  James  contends  that 
“we  don't  separate  ISR  from  operations  in  the  air  and  space  domains. 

In  cyberspace,  they're  even  more  closely  intertwined.”56  Therefore,  we 
need  doctrinal,  educational,  and  organizational  constructs  that  force¬ 
fully  emphasize  the  centrality  and  operational  nature  of  cyber  ISR— 
not  for  its  own  sake  but  in  recognition  of  the  fact  that  without  it  we  are 
functionally  deaf  and  blind,  to  the  detriment  of  all  operations. 

To  be  effective,  however,  cyber  ISR  needs  much  more  than  institu¬ 
tional  emphasis,  money,  or  people.  The  enterprise  must  adapt  its  tra¬ 
de  craft  to  match  the  operating  environment.  In  the  case  of  cyberspace, 
ISR  must  be  globally  aware  and  constantly  vigilant,  predictive  rather 
than  reactive,  dynamic  and  agile,  and  able  to  manage  exponentially  in¬ 
creasing  volumes  of  data.  This  vision  further  requires  changes  in  the 
way  we  recruit  and  train  cyber  ISR  professionals,  how  we  employ 
them  to  protect  civil  liberties  and  privacy,  and,  indeed,  how  we  inte¬ 
grate  cyber  ISR  into  the  unified  intelligence  enterprise. 

Predictive  ISR  and  Early  Warning 

According  to  observers  like  Mike  McConnell,  former  director  of  na¬ 
tional  intelligence,  the  current  “state  of  the  art”  in  cyberspace  ISR  and 
defense  relies  on  “after-the-fact  forensics”  to  assess  damage  and  iden¬ 
tify  perpetrators  of  individual  attacks.57  In  the  past,  we  have  also  relied 
on  perimeter  defense  and  firewalls,  but  capable  foes  ultimately  will 
find  a  way  to  bypass  or  breach  any  “Cyber  Maginot  Line,”  however  so¬ 
phisticated.58  Instead,  we  need  a  Cyber  Distant  Early  Warning  Line, 
with  attribution  and  defensive  capabilities  primed  to  respond  to 
threats  before  they  can  do  damage.59 
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To  facilitate  the  earliest  possible  warning  of  activity  occurring  liter¬ 
ally  in  the  blink  of  an  eye  mandates  a  more  predictive  approach  based 
on  real-time  global  awareness  of  cyber  activities  and  the  context  in 
which  they  occur.60  Predictive  cyber  ISR  builds  upon  past  experience 
and  emerging  trends  to  identify  indications  of  impending  digital  mis¬ 
chief,  such  as  preexisting  grievances  against  the  United  States,  an  ac¬ 
tive  “patriotic  hacker”  community,  online  chatter,  new  technologies,  or 
adversary  doctrine.61  We  must  monitor  these  and  other  potential  tip- 
offs  as  part  of  “a  continuous  process,  leveraging  indicators  to  discover 
new  activity  with  yet  more  indicators  to  leverage.”62 

Agile  and  Dynamic 

Of  course,  “early”  warning  is  relative.  During  the  Cold  War,  we  as¬ 
sumed  that  an  intercontinental  ballistic  missile  would  travel  some  30 
minutes  between  launch  and  impact,  but  today  a  cyber  strike  can  flash 
from  Beijing  to  New  York  City  in  30  milliseconds.63  Such  speed  re¬ 
quires  degrees  of  agility  and  dynamism  that  seem  fantastic,  even  fanci¬ 
ful  in  the  context  of  “physical”  warfare.  According  to  Dr.  Kamal  Jab- 
bour  of  the  Air  Force  Research  Laboratory,  “cyber  agility”  entails  not 
only  rapid  analysis  but  also  “anticipation  of  future  behaviors  and  ef¬ 
fects,  and  effective  real-time  provisioning  of  defensive  measures.”64 
This,  however,  demands  that  the  ISR  enterprise  at  least  tie  for  the  lead 
in  all  things  cyber:  speed,  stealth,  flexibility,  adaptability,  and  other 
factors  that  have  made  cyberspace  so  challenging  in  the  first  place.65 
Ongoing  scientific  and  technology  initiatives,  such  as  “Cyber  Vision 
2025,”  offer  a  valuable  starting  point  for  understanding  these  issues 
and  devising  solutions.  Secretary  of  the  Air  Force  Michael  Donley  has 
directed  the  service's  leadership  to  forge  a  way  forward  to  realize  that 
vision. 

Automation  and  Visualization 

The  vast  amount  of  data  collected  in  cyberspace  recalls  a  Chinese 
proverb:  “Absolute  light  and  absolute  darkness  have  the  same  effect— 
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we  cannot  see  anything.”66  At  present,  cyber  sensors  collect  petabytes 
of  data,  and  collection  of  yottabytes  is  not  far  off.67  Already,  however, 
the  collection  outstrips  our  ability  to  identify  the  "nuggets,"  analyze 
them,  and  fashion  them  into  actionable  intelligence.  Cyber  ISR,  there¬ 
fore,  "requires  the  development  of  algorithms  and  visualizations  capa¬ 
bilities  to  make  activities  in  the  cyber  domain  intelligible.”68  Technolo¬ 
gies  that  enable  automated  ISR  analysis,  operating  pictures,  and 
predictive  software  fall  to  one  side  of  the  equation  and  correctly  de¬ 
mand  more  intellectual  and  fiscal  attention.  No  less  important,  how¬ 
ever— and  arguably  paramount— is  the  element  on  the  other  side  of 
the  equal  sign:  the  human  variable. 

Recruiting  and  Training 

Many  of  us  are  so-called  digital  immigrants.  Our  hrst  direct  experience 
with  integrated  circuits  involved  a  1970s-vintage  calculator,  a  digital 
watch,  or  perhaps  early  video  games.  Cyberspace  and  the  speed  at 
which  it  evolves  continue  to  frustrate  and  sometimes  frighten  those 
who  stepped  off  the  analog  boat— willingly  or  otherwise— into  the  digi¬ 
tal  New  World.  Our  successors,  though,  are  a  different  breed.  Today’s 
recruits  may  well  have  had  their  birth  announced  via  e-mail;  they  may 
not  remember  a  single  moment  when  a  computer  was  not  within  im¬ 
mediate  view.  These  are  not  your  father's  Airmen.  They  are  still  the 
best  in  the  world,  but  “Fly,  Fight,  and  Win”  has  a  different  connotation 
to  someone  whose  idea  of  warfare  derives  primarily  from  nine  years  of 
playing  "Call  of  Duty.”  Yet,  potentially,  these  digital  natives  represent 
our  biggest  assets  in  the  realm  of  cyberspace.  Gen  Keith  B.  Alexander, 
director  of  the  National  Security  Agency  and  commander  of  US  Cyber 
Command,  apparently  recognizes  this,  having  recently  delivered  a  re¬ 
cruiting  pitch  at  a  convention  of  self-professed  hackers.69  The  requisite 
human  talent  is  there— and  abundant.  Once  onboard,  it  needs  only 
training  in  the  first-tier  standards  of  cyber  operations.  But  that  requires 
"deep  and  powerful  technical  and  analytic  expertise”— expertise  that 
must  continually  progress  to  match  the  domain's  explosive  evolution.70 
Although  Lieutenant  General  James  contends  that  cyber  ISR  training 
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is  improving,  the  task  is  not  yet  complete.71  Given  cyberspace's  contin¬ 
uous  evolution,  further  refinement  of  Air  Force  specialty  code-award¬ 
ing  syllabi;  graduate  courses;  and  tailored,  adaptive  on-the-job  training 
must  continue  to  rank  among  the  top  priorities  for  cyber  ISR. 

" Normalization ”  of  Cyber  ISR 

Manpower  and  training,  as  well  as  material  and  technologies,  have  re¬ 
cently  drawn  the  attention  of  multiple  high-level  initiatives  within  the 
DOD  and  the  Air  Force,  including  the  Air  Force  chief  scientist’s  “Cyber 
Vision  2025”  study;  the  2012  Air  Force  Cyber  Summit;  and  the  DOD's 
Cyber  Strategic  Portfolio  Review.  Concrete  outputs— and,  conse¬ 
quently,  future  cyber  ISR  capacity— will  depend  upon  the  results  of 
these  and  other  deliberations,  the  fiscal  environment,  and  the  contin¬ 
ued  evolution  of  cyber  threats  and  opportunities.  Conceptually,  how¬ 
ever,  work  can  and  should  begin  today  on  “normalizing”  cyber  ISR.  As 
Lieutenant  General  James  and  other  Air  Force  ISR  leaders  have  force¬ 
fully  maintained,  effective  ISR  must  be  seamless  and  domain-agnostic. 
ISR  seeks  to  deliver  timely,  relevant,  and  actionable  intelligence  to  the 
appropriate  decision  makers.  The  location  and  means  of  collecting  in¬ 
telligence  information  are  of  comparatively  little  significance  to  that 
ultimate  objective.  In  this  context,  normalization  involves  dismantling 
the  stovepipes  we've  erected  around  All  Things  Cyber  and  recognizing 
that,  in  the  end  analysis,  the  resulting  information  itself  matters  to  the 
mission— not  the  manner  or  domain  in  which  we  acquire  it.  Neverthe¬ 
less,  in  light  of  the  distinctiveness  of  the  cyber  domain,  the  compara¬ 
tive  newness  of  our  operations  within  it,  and  programmatic  practicali¬ 
ties,  we  still  have  multiple  mental  and  institutional  hurdles  to  clear 
before  ISR  for  and  from  cyber  is  as  readily  understood,  recognized, 
and  resourced  as  ISR  for  and  from  air  or  space.  Ultimately,  this  is  a 
question  of  education  and  leadership,  but  before  we  can  teach  and 
lead,  we  must  first  understand  that  cyberspace  has  come  into  its  own 
as  a  domain  that  presents  ISR  demands  and  opportunities  in  funda¬ 
mentally  the  same  manner  as  the  other  domains.  Intelligence  for  and 
from  space  was  also  new  and  conceptually  compartmentalized  in  the 
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not-so-distant  past,  but  its  contribution  to  operational  effectiveness  has 
grown  dramatically  with  its  diminishing  novelty. 

Protection  of  Civil  Liberties  and  Privacy 

Any  and  all  cyber  ISR  investments,  however,  must  adhere  to  the  gov¬ 
ernment’s  obligation  to  protect  civil  liberties  and  constitutional 
rights.72  Colonel  Simpson  acknowledges  that  "the  current  infancy  of 
cyber  law  and  policy  creates  difficulties  for  ISR  in  determining  and 
managing  authorities  and  boundaries.”73  The  balance  among  aware¬ 
ness,  security,  and  civil  liberties  is  an  evolving  one  that  demands  con¬ 
stant  attention  and  carries  considerable  implications  for  public  trust.74 
This  is  more  than  an  ancillary  concern  to  the  ISR  enterprise;  as  mili¬ 
tary  professionals  serving  our  citizens  and  Constitution,  these  issues 
warrant  continued  vigilance  and  strict  adherence.  Despite  today's  legal 
ambiguities  that  cloud  cyberspace  and  regardless  of  whatever  relevant 
court  decisions  appear  in  the  future,  the  entire  intelligence  commu¬ 
nity  must  remain  steadfastly  committed  to  the  Constitution  and  every 
citizen's  right  to  privacy. 


Conclusion 

Over  the  past  century,  the  Air  Force  and  its  predecessors  have  dem¬ 
onstrated  their  mastery  of  new  operational  domains— first  in  the  air 
and  later  in  space.  In  both  cases,  ISR  proved  critical  to  opening  and  se¬ 
curing  new  environments.  Cyberspace,  for  all  its  unique  attributes, 
shares  that  fundamental  trait:  the  absence  of  timely,  relevant,  and  ac¬ 
tionable  ISR  reduces  the  success  of  all  other  military  activities  to 
chance.  As  the  odds  stack  up  against  the  defender  in  this  new  domain, 
though,  relying  on  chance  is  not  an  option.75  The  difficulties  facing  cy¬ 
ber  ISR  sometimes  seem  insoluble,  but  they  only  appear  that  way.  No 
doubt  the  unprecedented  speed  of  airpower  caused  considerable 
mental  dislocation  during  its  maturation,  as  did  the  vastness  of  space 
in  the  following  decades.  Without  question,  as  we  enter  a  new  operating 
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environment,  we  will  encounter  many  of  the  same  intellectual  grow¬ 
ing  pains.  We  should  remain  confident,  however,  in  our  ability  to  over¬ 
come  them  through  an  increasingly  persistent  and  pervasive  under¬ 
standing  of  cyberspace  provided  by— and  contributing  to— cyber  ISR. 
To  continue  that  positive  trend,  we  must  invest;  to  invest,  we  must 
commit;  but  to  commit,  we  must  first  fully  understand  the  nature  and 
extent  of  the  challenges  and  opportunities  facing  us  as  an  Air  Force 
and  a  nation.  ISR  is  the  key  to  that  understanding— in  cyberspace  as  in 
every  other  domain  of  human  enterprise.  O 


Notes 

1 .  In  Neuromancer,  William  Gibson  prophetically  coined  the  term  cyberspace  to  hypothesize 
a  flight  of  science-fiction  fancy,  "a  consensual  hallucination  experienced  daily  by  billions.  .  .  . 
Data  abstracted  from  the  banks  of  every  computer  in  the  human  system.  Unthinkable  com¬ 
plexity.”  William  Gibson,  Neuromancer  (New  York:  Ace  Books,  1984),  69. 

2.  Joint  doctrine  defines  cyberspace  as  "a  global  domain  within  the  information  environ¬ 
ment  consisting  of  the  interdependent  network  of  information  technology  infrastructures, 
including  the  Internet,  telecommunications  networks,  computer  systems,  and  embedded 
processors  and  controllers.”  Joint  Publication  (JP)  1-02,  Department  of  Defense  Dictionary  of 
Military  and  Associated  Terms,  8  November  2010  (as  amended  through  15  August  2012),  77, 
http://www.dtic.mil/doctrine/new_pubs/jpl_02.pdf.  The  author,  however,  is  compelled  to 
agree  that  "'Cyber'  itself  is  such  a  nebidous  concept  that  determining  the  fundamentals  of 
what  it  is  and  how  it  affects  the  military  domain  has  exercised  years  of  planning  man¬ 
hours.”  Daniel  Wasserbly,  "Charting  the  Course  through  Virtual  Enemy  Territory,"  Jane's 
International  Defence  Review  44,  no.  5  (May  2011):  60.  Or,  as  Gen  Michael  V.  Hayden,  USAF, 
retired,  observed,  "Rarely  has  something  been  so  important  and  so  talked  about  with  less 
clarity  and  less  apparent  understanding  than  this  phenomenon."  Michael  V.  Hayden,  “The 
Future  of  Things  ‘Cyber,’  ”  Strategic  Studies  Quarterly  5,  no.  1  (Spring  2011):  3,  http://www 
.au.af.mil/au/ssq/2011/spring/hayden.pdf. 

3.  This  article  does  not  address  threats— the  literature  regarding  that  subject  is  as  expan¬ 
sive  and  varied  as  the  threats  themselves.  However,  in  all  military  operations,  effective 
threat  response  begins  with  conceptually  sound,  well-planned,  and  well-executed  ISR. 

4.  For  CYBINT  see  Dr.  Kamal  T.  Jabbour,  50  Cyber  Questions  Every  Airman  Can  Answer 
(Wright-Patterson  AFB,  OH:  Air  Force  Research  Faboratory,  7  May  2008),  20,  http://www 
.au.af.mil/au/awc/awcgate/afrl/50_cyber_questions.pdf;  for  CYBINT's  relationship  to  sig¬ 
nals  intelligence,  see,  for  example,  Air  Force  Doctrine  Document  (AFDD)  2-0,  Global  Inte¬ 
grated  Intelligence,  Surveillance,  &  Reconnaissance  Operations,  6  January  2012,  40,  http:// 
www.e-publishing.af.mil/shared/media/epubs/afdd2-0.pdf;  and  for  open-source  intelligence 
as  described  by  Frederick  J.  Wettering,  see  “The  Internet  and  the  Spy  Business,”  International 
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Journal  of  Intelligence  and  Counterintelligence  14,  no.  3  (Fall  2001):  344.  See  also  "Cyber  Vi¬ 
sion  2025:  United  States  Air  Force  Cyberspace  Science  and  Technology  Vision  2012-2025,” 
draft,  AF/ST  TR  12-01,  1  September  2012,  42.  "VoIP”  refers  to  Voice  over  Internet  Protocol 
applications. 

5.  Ben  Iannotta,  "Voice  for  Balance,”  DefenseNews,  1  November  2011,  http://www 
.  defensenews.com/ article/20111101 /C4ISR01/111010318/Voice-balance. 
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